lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

net: fix potential neighbour race in dst_ifdown()

Browse Source 
Followup of commit f2c31e32b3 (fix NULL dereferences in
check_peer_redir()).

We need to make sure dst neighbour doesnt change in dst_ifdown().

Fix some sparse errors.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet
2011-08-08 20:56:14 +00:00
committed by David S. Miller
parent 19fd61785a
commit 9de79c127c
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
net/core/dst.c
View File

@@ -171,7 +171,7 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
dst_init_metrics(dst, dst_default_metrics, true); dst_init_metrics(dst, dst_default_metrics, true);
dst->expires = 0UL; dst->expires = 0UL;
dst->path = dst; dst->path = dst;
dst->_neighbour = NULL; RCU_INIT_POINTER(dst->_neighbour, NULL);
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
dst->xfrm = NULL; dst->xfrm = NULL;
#endif #endif
@@ -229,11 +229,11 @@ struct dst_entry *dst_destroy(struct dst_entry * dst)
smp_rmb(); smp_rmb();
again: again:
neigh = dst->_neighbour; neigh = rcu_dereference_protected(dst->_neighbour, 1);
child = dst->child; child = dst->child;
if (neigh) { if (neigh) {
dst->_neighbour = NULL; RCU_INIT_POINTER(dst->_neighbour, NULL);
neigh_release(neigh); neigh_release(neigh);
} }
@@ -360,14 +360,19 @@ static void dst_ifdown(struct dst_entry *dst, struct net_device *dev,
if (!unregister) { if (!unregister) {
dst->input = dst->output = dst_discard; dst->input = dst->output = dst_discard;
} else { } else {
struct neighbour *neigh;
dst->dev = dev_net(dst->dev)->loopback_dev; dst->dev = dev_net(dst->dev)->loopback_dev;
dev_hold(dst->dev); dev_hold(dst->dev);
dev_put(dev); dev_put(dev);
if (dst->_neighbour && dst->_neighbour->dev == dev) { rcu_read_lock();
dst->_neighbour->dev = dst->dev; neigh = dst_get_neighbour(dst);
if (neigh && neigh->dev == dev) {
neigh->dev = dst->dev;
dev_hold(dst->dev); dev_hold(dst->dev);
dev_put(dev); dev_put(dev);
} }
rcu_read_unlock();
} }
} }